A vulnerability in urllib3's streaming API can cause excessive CPU and memory usage when handling highly compressed HTTP responses. This occurs because the decompression logic may fully decode a small amount of highly compressed data in one operation, leading to resource exhaustion on the client side. The issue affects urllib3 versions up to 2.5.0 and impacts applications streaming large compressed responses from untrusted sources. The vulnerability is fixed in urllib3 version 2.6.0 and requires upgrading Brotli packages if used. The CVSS 4.0 score rates this as a high severity issue.